PT-2014-4624 · Ruby · Arabic Prawn

Larry W. Cashdollar + 1 · Publicado 2014-05-02 · Atualizado 2017-10-24 · CVE-2014-2322

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Arabic Prawn gem version 0.0.1

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the downloaded file or url variable. This is due to a problem in the lib/string utf support.rb file of the Arabic Prawn gem for Ruby.

Recommendations For Arabic Prawn gem version 0.0.1, consider disabling the use of the downloaded file and url variables until a patch is available to prevent the execution of arbitrary commands. Avoid using the downloaded file and url variables in sensitive operations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2014-2322

GHSA-HGMW-X865-HF9X

Produtos afetados

Arabic Prawn

Referências · 7

• 🔥 http://openwall.com/lists/oss-security/2014/03/10/8 · Exploit
• 🔥 http://vapid.dhs.org/advisories/arabic-ruby-gem.html · Exploit
• https://github.com/ozeron/prawn-arabic · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-2322 · Nota de Segurança
• http://openwall.com/lists/oss-security/2014/03/12/6 · Nota
• https://web.archive.org/web/20160306235714/http://vapid.dhs.org/advisories/arabic-ruby-gem.html · Nota
• https://osv.dev/vulnerability/GHSA-hgmw-x865-hf9x · Aviso do Fabricante